Palo Alto Networks XDR Analyst - XDR-Analyst FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

What is the difference between presets and datasets in XQL?

A. A dataset is a built-in or third-party source; presets group XDR data fields. B. A dataset is a third-party data source; presets are built-in data source. C. A dataset is a Cortex data lake data source only; presets are built-in data source. D. A dataset is a database; presets is a field.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

A. WebSocket B. NetBIOS over TCP C. TCP, over port 80 D. UDP and a random port

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?

A. JIT Mitigation B. UASLR C. DLL Security D. Memory Limit Heap spray check

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 4

In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?

A. Slack B. Service Now C. Salesforce D. Jira

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

A. In the Restrictions Profile, add the file name and path to the Executable Files allow list. B. Add the signer to the allow list in the malware profile. C. Create a new rule exception and use the singer as the characteristic. D. Add the signer to the allow list under the action center page.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

A. Causality Analysis Engine B. Sensor Engine C. Causality Chain Engine D. Log Stitching Engine

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Which statement is true based on the following Agent Auto Upgrade widget?

A. Agent Auto Upgrade has not been enabled. B. There are a total of 689 Up To Date agents. C. There are more agents in Pending status than In Progress status. D. Agent Auto Upgrade was enabled but not on all endpoints.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR Analytics module?

A. It does not interfere with any portion of the pattern on the endpoint. B. It interferes with the pattern as soon as it is observed on the endpoint. C. It does not need to interfere with the any portion of the pattern to prevent the attack. D. It interferes with the pattern as soon as it is observed by the firewall.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

Which of the following Live Terminal options are available for Android systems?

A. Live Terminal is not supported. B. Stop an app. C. Run Android commands. D. Run APK scripts.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 10

Which statement is true for Application Exploits and Kernel Exploits?

A. The ultimate goal of any exploit is to reach the application. B. Kernel exploits are easier to prevent then application exploits. C. Application exploits leverage kernel vulnerability. D. The ultimate goal of any exploit is to reach the kernel.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).